       (testing "filters (such as status) should be applied *after* the distinct list of most recent events has been built up"
         (let [expected  #{}
               actual    (resource-events-query-result
-                          version
-                          ["and" ["=" "certname" "foo.local"]
-                                 ["=" "status" "success"]
-                                 ["=" "resource-title" "notify, yar"]]
-                          {} {:distinct-resources? true
-                              :distinct-start-time (to-timestamp 0)
-                              :distinct-end-time   (to-timestamp (now))})]
+                         version
+                         ["and" ["=" "certname" "foo.local"]
+                          ["=" "status" "success"]
+                          ["=" "resource-title" "notify, yar"]]
+                         {} {:distinct-resources? true
+                             :distinct-start-time (to-timestamp 0)
+                             :distinct-end-time   (to-timestamp (now))})]
           (is (= (count expected) (count actual)))
-          (is (= actual expected))))))
-
-  (deftest paging-results
-    (let [basic4        (store-example-report! (:basic4 reports) (now))
-          events        (get-in reports [:basic4 :resource-events])
-          event-count   (count events)
-          select-values #(reverse (kitchensink/select-values (get-events-map (:basic4 reports)) %))]
-
+          (is (= actual expected)))))))
+
+(deftest paging-results
+  (let [basic4        (store-example-report! (:basic4 reports) (now))
+        events        (get-in reports [:basic4 :resource-events])
+        event-count   (count events)
+        select-values #(reverse (kitchensink/select-values (get-events-map (:basic4 reports)) %))]
+    (doseq [version [:v3 :v4]]
       (testing "include total results count"
         (let [actual (:count (raw-resource-events-query-result version [">" "timestamp" 0] {:count? true}))]
           (is (= actual event-count))))

        (testing "should return the list of resource events that occurred before a given time"
          (let [end-time  "2011-01-01T12:00:03-03:00"
                expected    (expected-resource-events
                              (kitchensink/select-values basic-events-map [1 3])
                              basic)
                actual      (resource-events-query-result version ["<" "timestamp" end-time])]
            (is (= actual expected))))
        (testing "should return the list of resource events that occurred after a given time"
          (let [start-time  "2011-01-01T12:00:01-03:00"
                expected    (expected-resource-events
                              (kitchensink/select-values basic-events-map [2 3])
                              basic)
                actual      (resource-events-query-result version [">" "timestamp" start-time])]
            (is (= actual expected))))
        (testing "should return the list of resource events that occurred between a given start and end time"
          (let [start-time  "2011-01-01T12:00:01-03:00"
                end-time    "2011-01-01T12:00:03-03:00"
                expected    (expected-resource-events
                              (kitchensink/select-values basic-events-map [3])
                              basic)
                actual      (resource-events-query-result
                              version
                              ["and"  [">" "timestamp" start-time]
                                      ["<" "timestamp" end-time]])]
            (is (= actual expected))))
        (testing "should return the list of resource events that occurred between a given start and end time (inclusive)"
          (let [start-time  "2011-01-01T12:00:01-03:00"
                end-time    "2011-01-01T12:00:03-03:00"
                expected    (expected-resource-events
                              (kitchensink/select-values basic-events-map [1 2 3])
                              basic)
                actual      (resource-events-query-result
                              version
                              ["and"   [">=" "timestamp" start-time]
                                       ["<=" "timestamp" end-time]])]
            (is (= actual expected)))))

      (testing "when querying with a limit"
        (let [num-events (count basic-events)]
          (testing "should succeed if the number of returned events is less than the limit"
            (is (= num-events
                  (count (resource-events-limited-query-result version (inc num-events) ["=" "report" report-hash])))))
          (testing "should fail if the number of returned events would exceed the limit"
            (is (thrown-with-msg?
              IllegalStateException #"Query returns more than the maximum number of results"
              (resource-events-limited-query-result version (dec num-events) ["=" "report" report-hash]))))))

      (testing "equality queries"
        (doseq [[field value matches]
                    [[:resource-type    "Notify"                            [1 2 3]]
                     [:resource-title   "notify, yo"                        [1]]
                     [:status           "success"                           [1 2]]
                     [:property         "message"                           [1 2]]
                     [:property         nil                                 [3]]
                     [:old-value        ["what" "the" "woah"]               [1]]
                     [:new-value        "notify, yo"                        [1]]
                     [:message          "defined 'message' as 'notify, yo'" [1 2]]
                     [:message          nil                                 [3]]
                     [:resource-title   "bunk"                              []]
                     [:certname         "foo.local"                         [1 2 3]]
                     [:certname         "bunk.remote"                       []]
                     [:file             "foo.pp"                            [1]]
                     [:file             "bar"                               [3]]
                     [:file             nil                                 [2]]
                     [:line             2                                   [3]]
                     [:line             nil                                 [2]]
                     [:containing-class "Foo"                               [3]]
                     [:containing-class nil                                 [1 2]]]]
          (testing (format "equality query on field '%s'" field)
            (let [expected  (expected-resource-events
                              (kitchensink/select-values basic-events-map matches)
                              basic)
                  query     ["=" (name field) value]
                  actual    (resource-events-query-result version query)]
              (is (= actual expected)
                (format "Results didn't match for query '%s'" query))))))

      (testing "'not' queries"
        (doseq [[field value matches]

                 [:containing-class nil                                 [3]]]]
          (testing (format "'not' query on field '%s'" field)
            (let [expected  (expected-resource-events
                             (kitchensink/select-values basic-events-map matches)
                             basic)
                  query     ["not" ["=" (name field) value]]
                  actual    (resource-events-query-result version query)]
              (is (= actual expected)
                  (format "Results didn't match for query '%s'" query))))))

      (testing "regex queries"
        (doseq [[field value matches]
